The posting
WPP is the trusted growth partner for the world’s leading brands.
We unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company – powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth.
We work with the world's most valuable brands and have global reach across 100+ markets, with deep local expertise.
Our people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow.
For more information, visit WPP.com.
Role Purpose
The Governance & Assurance Analyst supports WPP's governance, certification, assurance, and digital risk management activities.
The role helps maintain governance documentation, support certification and audit readiness activities, coordinate evidence collection, and contribute
to client assurance requests and governance reporting.
Working closely with Strategy & Risk, Technical Security Governance, Assurance, Privacy, Legal, Enterprise Technology, and business stakeholders,
the Governance & Assurance Analyst helps ensure governance processes remain effective, documentation remains current, and evidence required
for certifications, audits, and client assurance activities is readily available.
A key focus of the role is supporting the day-to-day operation of WPP's Information Security Management System (ISMS), maintaining certification
readiness, and coordinating governance and assurance activities across the organisation.
Key Responsibilities
Governance & Policy Support
Maintain governance frameworks, policies, standards, procedures, and related documentation.
Support periodic reviews and updates of governance artefacts.
Maintain mappings between policies, standards, controls, and certification requirements.
Assist with governance forums, working groups, and documentation reviews.
Support the preparation of governance materials, meeting outputs, and action tracking.
Provide research and analysis to support governance activities and decision-making.
Digital Risk Governance Support
Support governance reporting activities related to digital risk management.
Assist with the collection and analysis of governance-related metrics and indicators.
Maintain governance dashboards, scorecards, and reporting materials.
Track governance actions and follow-up activities.
Support reviews of governance processes and documentation.
ISO 27001 & Certification Support
Support the operation of the Information Security Management System (ISMS).
Coordinate activities required to support ISO 27001 certification and surveillance audits.
Maintain certification-related records, registers, and supporting documentation.
Coordinate evidence collection and stakeholder engagement activities required for audits.
Track audit findings, corrective actions, and improvement activities through to closure.
Support management review preparation and governance reporting.
Help maintain ongoing audit and certification readiness.
Client Assurance Support
Coordinate responses to client security, governance, risk, and compliance due diligence requests.
Collaborate with relevant stakeholders to gather information required for assurance activities.
Maintain reusable assurance content, responses, and supporting evidence.
Track assurance requests and response status.
Support the continuous improvement of assurance documentation and response quality.
Evidence Management & Audit Readiness
Maintain repositories used to support governance, certification, audit, and assurance activities.
Coordinate evidence collection across relevant business functions.
Ensure evidence is current, appropriately classified, and available for authorised use.
Maintain evidence ownership information, review dates, and supporting metadata.
Identify missing, outdated, or incomplete evidence and coordinate remediation activities.
Support internal, external, certification, client, and regulatory reviews through effective evidence coordination.
Reporting & Operational Improvement
Support the development of governance dashboards, scorecards, metrics, and reporting packs.
Analyse governance and assurance data to identify trends and reporting insights.
Support the standardisation of governance documentation, evidence collection, and reporting practices.
Identify opportunities for process improvements and raise recommendations to management.
Contribute to the continuous improvement of governance operational processes and reporting effectiveness.
Skills & Experience Required
Must-Haves
Fluent English, written and verbal.
Bachelor's degree in Information Security, Risk Management, Audit, Compliance, Business Administration, or a related discipline, or
equivalent relevant experience.
2-4 years of experience in governance, information security, compliance, audit, risk management, assurance, or a related discipline.
Experience supporting an ISO 27001-based management system, audit programme, or certification activity.
Understanding of governance frameworks, controls, audit principles, and certification requirements.
Experience supporting audits, assurance reviews, or certification activities.
Experience coordinating evidence collection and documentation activities.
Strong reporting, documentation, and organisational skills.
Ability to work effectively with technical and non-technical stakeholders.
Strong communication and stakeholder coordination skills.
Ability to manage multiple priorities in a global environment.
Nice-to-Have
ISO 27001 Foundation, Lead Implementer, Lead Auditor, or similar qualification.
CISA, CISM, CRISC, CISSP, or equivalent certification.
Exposure to frameworks such as SOC 2, GDPR, NIS2, or similar.
Experience supporting client assurance or security questionnaire activities.
Experience using GRC, audit, compliance, or certification management platforms.
Experience within a large multinational organisation.
Key Behaviours & Competencies
Governance Awareness
Understands the importance of governance, accountability, and effective documentation in supporting organisational objectives.
Analytical Thinking
Uses structured analysis and evidence-based reasoning to support governance activities and reporting.
Quality Focus
Maintains attention to detail and supports high-quality governance and assurance outcomes.
Stakeholder Collaboration
Works effectively with stakeholders across business and technical teams.
Communication
Communicates clearly and professionally with a range of audiences.
Organisation & Planning
Demonstrates a structured approach to documentation, coordination, reporting, and action tracking.
Continuous Learning
Seeks opportunities to improve processes, skills, and ways of working.
Professional Integrity
Acts with objectivity, accountability, professionalism, and discretion.
What This Role Explicitly Does Not Do
This role does not:
Own governance frameworks, policies, or standards.
Own cyber security strategy.
Own enterprise risk management processes or risk registers.
Own Digital Risk Governance frameworks.
Make risk acceptance or risk treatment decisions.
Own technical security controls, security architecture, engineering, or operational security functions.
Perform incident response, vulnerability management, monitoring, or security operations activities.
Act as Internal Audit or provide independent assurance.
Own regulatory compliance programmes.
Serve as the accountable owner for ISO 27001 or certification outcomes.
Own the ISMS.
Design governance operating models or policy architectures.
Approve policies, standards, exceptions, or governance decisions unless formally authorised.
Replace the accountability of risk owners, control owners, policy owners, or business stakeholders.
Who you are:
You're open: We are inclusive and collaborative; we encourage the free exchange of ideas; we respect and celebrate diverse views. We are open-minded: to new ideas, new partnerships, new ways of working.
You're optimistic: We believe in the power of creativity, technology and talent to create brighter futures or our people, our clients and our communities. We approach all that we do with conviction: to try the new and to seek the unexpected.
You're extraordinary: we are stronger together: through collaboration we achieve the amazing. We are creative leaders and pioneers of our industry; we provide extraordinary every day.
What we'll give you:
Passionate, inspired people – We aim to create a culture in which people can do extraordinary work.
Scale and opportunity – We offer the opportunity to create, influence and complete projects at a scale that is unparalleled in the industry.
Challenging and stimulating work – Unique work and the opportunity to join a group of creative problem solvers. Are you up for the challenge?
#LI-Hybrid
We believe the best work happens when we're together, fostering creativity, collaboration, and connection. That's why we’ve adopted a hybrid approach, with teams in the office around four days a week. If you require accommodations or flexibility, please discuss this with the hiring team during the interview process.
WPP is an equal opportunity employer and considers applicants for all positions without discrimination or regard to particular characteristics. We are committed to fostering a culture of respect in which everyone feels they belong and has the same opportunities to progress in their careers.
